{
  "requestId": "vq_5c59866f",
  "ruleVersion": "vurqel-eligibility-v1",
  "state": "EXPOSED",
  "reasonCode": "EXPOSED_SAME_SHA_PATH",
  "reason": "A complete same-SHA provenance path proves this build resolved the affected package during its live window.",
  "package": {
    "ecosystem": "npm",
    "name": "@tanstack/react-router",
    "version": "1.169.8"
  },
  "interval": {
    "from": "2026-05-11T19:26:14Z",
    "to": "2026-05-11T22:13:38Z"
  },
  "repository": "RelativeSure/websites",
  "sources": [
    {
      "label": "incident",
      "url": "https://tanstack.com/blog/npm-supply-chain-compromise-postmortem"
    },
    {
      "label": "lockfile",
      "url": "https://github.com/RelativeSure/websites/blob/939d3bd1b05ee09f0f4c2585a492f98da0fd066d/tools/pnpm-lock.yaml"
    },
    {
      "label": "commit",
      "url": "https://github.com/RelativeSure/websites/commit/939d3bd1b05ee09f0f4c2585a492f98da0fd066d"
    },
    {
      "label": "workflow",
      "url": "https://github.com/RelativeSure/websites/blob/939d3bd1b05ee09f0f4c2585a492f98da0fd066d/.github/workflows/ci.yml"
    },
    {
      "label": "workflow-run",
      "url": "https://github.com/RelativeSure/websites/actions/runs/25698962181"
    },
    {
      "label": "ci-job",
      "url": "https://github.com/RelativeSure/websites/actions/runs/25698962181/job/75454350988"
    },
    {
      "label": "service-build",
      "url": "https://github.com/RelativeSure/websites/runs/75454451577"
    }
  ],
  "generatedAt": "2026-08-18T15:11:14.818Z",
  "limitations": [
    "Frozen-install proof is the immutable workflow definition plus the named job result; raw step logs are not used."
  ],
  "claimBoundary": "Proves build provenance only: a compromised package was resolved in the incident window and a same-SHA production-labelled build succeeded. Does NOT prove malware execution, credential theft, or end-user traffic.",
  "commitSha": "939d3bd1b05ee09f0f4c2585a492f98da0fd066d",
  "lockfile": {
    "path": "tools/pnpm-lock.yaml",
    "contentHash": "sha256:04916898507a414af7e59f9083ade5f604a0358ae676ad216e50d0f605330f6d"
  },
  "workflowRunId": "25698962181",
  "ciJob": {
    "name": "Build (tools)",
    "conclusion": "success"
  },
  "serviceBuild": {
    "provider": "cloudflare",
    "service": "websites-tools",
    "environmentLabel": "production",
    "checkRunId": "75454451577"
  },
  "snapshot": {
    "bookmark": "sgk:1:64656661756c74:64656661756c74:63656c6c2d30:15",
    "readEpoch": 15
  },
  "mode": "online"
}